What attackers exploit in 2026, and what we test for
In 2026 most serious intrusions do not need a new zero-day. They use stolen identities and session tokens, vulnerabilities in internet-facing appliances exploited within days of disclosure, broken authorisation in APIs, over-privileged cloud roles, poisoned build pipelines, and, increasingly, prompt injection against AI features. These are the techniques ITovio tests for.
Enterprise only. Cyber security is the one service ITovio offers at enterprise level: established companies and enterprises with production systems worth attacking properly. We do not sell low-budget scans or small-business security packages.
- Security leaders setting the scope of this year's testing.
- CTOs and platform owners who want to know where attackers start now.
- Boards and investors asking whether last year's test still reflects current risk.
Definitive results, not maybes
Proven, not suspected
Every finding in the report is exploited by hand and shipped with a working proof of concept, reproduction steps and evidence. No unverified scanner output, no "potential" issues padding the page count.
Ranked by business impact
Severity is scored with CVSS and then argued in plain language: what an attacker reaches, which data, which customers, what it would cost you.
Closed means closed
After you fix, we attack the same issue again. The retest report states, per finding, whether it is closed, partly closed or still open.
A clean result is still a result
If a target holds, the report says exactly what was attacked, how and for how long, so "nothing exploitable found" is evidence you can hand to a customer, auditor or board.
The techniques, and how we test for each
Drawn from public sources: the CISA Known Exploited Vulnerabilities catalogue, vendor advisories, OWASP projects and published incident reports. We name techniques, not tools, and we test only with written authorisation.
| Technique | Why it matters now | How we test for it |
|---|---|---|
| Identity and token theft | Attackers log in rather than break in: stolen session cookies, OAuth tokens and refresh tokens bypass passwords and MFA alike. | Token lifetime, binding and revocation; OAuth consent and redirect flaws; what a stolen session can reach. |
| Edge-device exploitation | VPN gateways, firewalls and file-transfer appliances keep appearing in the CISA KEV catalogue, often exploited soon after a fix is published. | Inventory of exposed appliances, version and configuration checks against current advisories, and safe proof where in scope. |
| API authorisation flaws | APIs expose objects by ID; one missing ownership check leaks every customer's records. | Every object and function swapped between users and tenants, per the OWASP API Security Top 10. |
| Cloud privilege escalation | One leaked key or compromised workload becomes account-wide control through over-broad roles. | Starting from a realistic foothold and mapping the path to admin, storage and data. |
| CI/CD and supply-chain poisoning | Build pipelines hold production secrets and can be triggered by outsiders through pull requests and dependencies. | Workflow triggers, secret exposure, runner privileges, dependency confusion and registry permissions. |
| Active Directory attack paths | Still the shortest route from one phished employee to the whole company. | Assumed-breach testing of Kerberos, delegation, ACLs and certificate services abuse. |
| Server-side request forgery | A URL parameter becomes a path into internal services and cloud metadata credentials. | Every URL, webhook and import feature pointed inward, with metadata service protections checked. |
| Race conditions | Limits on balances, coupons and votes can be beaten when requests arrive at the same instant, now practical to exploit reliably. | Concurrent request testing on every limit and one-time action in scope. |
| HTTP desync and cache attacks | Differences between proxies, CDNs and back ends let attackers poison caches or hijack other users' requests. | Request smuggling, cache poisoning and cache deception tests across your delivery chain. |
| Prompt injection and agent abuse | AI features read untrusted content and can be steered into leaking data or taking actions. | Direct and indirect injection, tool permissions and output handling, per the OWASP Top 10 for LLM Applications. |
How we keep testing current
Techniques change faster than methodologies are updated. During every engagement we check newly published vulnerabilities and advisories against the technology in your scope, and test the relevant ones before the report is written, not in next year's test.
If a critical issue in your stack is disclosed while we are testing, you hear about it the same day, with whether you are exposed.
Asked before most engagements
Do you develop zero-day exploits?
Do you test for newly disclosed vulnerabilities?
Is this list complete?
Reviewed by the ITovio security team on 3 November 2026.
Related
Penetration test vs vulnerability scan: the real difference
Read itServiceAI and LLM application penetration testing
Read itServiceCloud penetration testing for AWS, Azure and Google Cloud
Read itServiceAPI penetration testing for REST and GraphQL
Read itAll specialist testing: Web application testing, API testing, Cloud testing, Network and Active Directory, Mobile app testing, AI and LLM testing, Red team and attack simulation.
Find out what an attacker would find first.
A 30-minute scoping call, then a written scope with targets, depth, windows and deliverables before you commit. Enterprise engagements only.
